- Freeradius-Users - lists.freeradius.org

Auth-Type already set?
by Lorenzo Milesi 15 Dec '12

15 Dec '12

I'm having a problem with FR2.1.10 and MD5 Passwords with MySQL. When I try to enable PAP I get the following: # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "F0073402", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> F0073402 [...] rlm_sql (sql): Released sql socket id: 22 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop the sites-enabled/default is: authorize { preprocess chap mschap digest suffix eap { ok = return } files sql expiration logintime pap noresetcounter dailycounter monthlycounter } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix sql exec attr_filter.accounting_response } session { sql } post-auth { sql exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } What's wrong? :( thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

3 3

EAP
by David Peterson 13 Dec '12

13 Dec '12

I wanted to ping the Eduroam people about EAP over WAN links. Are there considerations that can cause connectivity issues that I should be examining? David

3 6

refowarding the radius request when authentication fails
by laurent.feron＠free.fr 13 Dec '12

13 Dec '12

Hello, in the authentication step, i try several authentication against otp server, but if all are failed if the user is not know, i would like to re forward the radius request to another radius server. except the suffix mechanism in authorize section that i know a little bit, i don't see how to do that easily in the authentication section. The only solution i see, but not very nice, is to build a radius client in perl (define in the authentication function (rlm_perl)). If someone has an idea ??? Regards, Laurent

2 2

share information between authorize and authenticate sections (rlm_perl & rlm_python)
by laurent.feron＠free.fr 13 Dec '12

13 Dec '12

Hello, If someone can advise me... How to share information between the authorize() function and the authenticate() function within a perl or python script ? For example, i get some information from a database in authorize() that will reuse it in authenticate()? I could resubmit the sql request again, but it is clearly not efficient. in perl, i could write some new attributes in RAD_CHECK ??, then authenticate() will access them. in python, attributes are read only, so i cannot use them to pass information to authenticate(). A simple database, like redis, could be a solution by adding info with the id of the request (with Message-Authenticator as key)? If someone has an idea, it is very welcome... Regards, Laurent

3 3

Max-Daily-Session Default value when user get disconnected
by John Doe 12 Dec '12

12 Dec '12

I need to know if you can add a default value such as 10 minutes each time a user logs out even though it was connected just one minute? Thanks in advance!!

1 0

Released IP info
by Raz Muhammad 12 Dec '12

12 Dec '12

Hi, I have a very simple query regarding following radius.log entry when a PPP session is disconnected following log entry is logged: "Sun Dec 9 20:46:05 2012 : Info: Released IP xx.xx.xx.xx (did cli 010010010 user xxx@xxx)" I would like to know what part of the configuration will enable/disable "Released IP" logging to radius.log file. I am using the "default" site file. It used to work for me before, but I had to make a change to disable simultaneous login feature. I disabled the radutmp feature in the sites default file in the "accounting" section and the "session" section. I also disabled "sqlippool" feature which is was left enabled for some reason, but we don't use any sqlippool feature. Regards Raz

2 2

Re: Eduroam & FreeRadius not working so well
by Alan Buxey 11 Dec '12

11 Dec '12

In the first instance, upgrade. There is a major security problem with 2.1.x release. Get 2.2.x onto your system asap. What are your NAS (cisco controllers) timeouts? Is this box a pure proxy or does it do authentication too? Have you enabled ciscos status-check system so it knows the RADIUS server isn't dead but just hasn't had a remote response yet? Around 67% of eduroam sites in the UK use freeradius alan

6 13

Setting up multiple NULL realms
by Chris Taylor 11 Dec '12

11 Dec '12

I am trying to collapse multiple domains into one RADIUS server (version 2-2.1.12-4.el5_8)with and LDAP backend. I have everything that has a realm suffix working I.E. username@domain-name, RADIUS will strip the username query the LDAP server (each domain has its own OU)and life is good. The problem I am running into is this. Each of the domains that I am collapsing had multiple users that would just connect with "username". I can setup the NULL realm but I have only been successful in getting it to work for one of my domains (domain-1.com) all others (I.E. domain-2.com, domain-3.com) will get a password reject error as it queries against that virtual server and subsequent OU, I have tried to setup multiple virtual servers in the realm NULL setup but that doesn't work. I have looked in the mailing list archives and searched the net but I have not been able to find anything related to this. Proxy.conf setup realm NULL { virtual_server = virtual.domain-1.com virtual_server = virtual.domain-1.com } Users file setup DEFAULT Realm == "NULL", Service-Type == Framed-User, Huntgroup-Name == bras Filter-Id = "NoRealm", Fall-Through = Yes What way should I be going about this? Thanks, Chris

2 1

Re: computer authentication
by Alan Buxey 10 Dec '12

10 Dec '12

Hi, you probably want to set peap as your default EAP type in eap.conf to save s couple of packets and a NAK. I don't see the ntlm_auth being called, have you edited the mschap module? The host name is rather short....are you sure this host is bound into an AD? alan

4 12

AW: Freeradius + LDAP
by Matthias Nagel 10 Dec '12

10 Dec '12

Hello, what exactly ist your problem? a) Do you want to know how to configure a web administration GUI (phpldapadmin) for your LDAP server? Then your problem is purly related to LDAP server, PHP and a web server. Hence, this is Thermometer wrong mailing list to ask for advice. b) Or do you want to know how to use a LDAP directory as a password backend? But then this question has nothing to do with phpldapadmin. You said, that RADIUS is already configured and running. Where are the user credentials stored at the moment? Matthias Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 ICQ: 499797758 Skype: nagmat84Brekler Custodio <brekler88(a)hotmail.com> hat geschrieben:Hello guys, i was wondering, anyone knows how to configure an LDAP (phpldapadmin) to work with freeradius ? I search all over the web and couldnt find a tutorial that teachs how to configure a simple DB to work with FR. The FR is configured already, its very simple, but the LDAP i cant handle.

1 0